Merge pull request #2083 from pikasTech/feat/pikaoa-test-db
PikaOA：声明 PK01 独立测试数据库与角色
This commit is contained in:
Lyon
@@ -10,6 +10,7 @@ metadata:
|
||||
- 281
|
||||
- 297
|
||||
- 300
|
||||
- 2078
|
||||
|
||||
cluster:
|
||||
role: primary
|
||||
@@ -374,6 +375,16 @@ postgres:
|
||||
user: pikaoa
|
||||
address: 152.53.229.148/32
|
||||
method: scram-sha-256
|
||||
- type: hostssl
|
||||
database: pikaoa_test
|
||||
user: pikaoa_test
|
||||
address: 10.0.8.0/22
|
||||
method: scram-sha-256
|
||||
- type: hostssl
|
||||
database: pikaoa_test
|
||||
user: pikaoa_test
|
||||
address: 152.53.229.148/32
|
||||
method: scram-sha-256
|
||||
|
||||
secrets:
|
||||
source: master-local
|
||||
@@ -491,6 +502,20 @@ secrets:
|
||||
PIKAOA_DB_NAME: pikaoa
|
||||
randomHex:
|
||||
PIKAOA_DB_PASSWORD: 32
|
||||
- name: pikaoa-test-db-credentials
|
||||
sourceRef: platform-db/pikaoa-test-db.env
|
||||
type: env
|
||||
requiredKeys:
|
||||
- PIKAOA_TEST_DB_USER
|
||||
- PIKAOA_TEST_DB_PASSWORD
|
||||
- PIKAOA_TEST_DB_NAME
|
||||
createIfMissing:
|
||||
enabled: true
|
||||
values:
|
||||
PIKAOA_TEST_DB_USER: pikaoa_test
|
||||
PIKAOA_TEST_DB_NAME: pikaoa_test
|
||||
randomHex:
|
||||
PIKAOA_TEST_DB_PASSWORD: 32
|
||||
objects:
|
||||
roles:
|
||||
- name: sub2api
|
||||
@@ -565,6 +590,15 @@ objects:
|
||||
createdb: false
|
||||
createrole: false
|
||||
superuser: false
|
||||
- name: pikaoa_test
|
||||
passwordRef:
|
||||
sourceRef: platform-db/pikaoa-test-db.env
|
||||
key: PIKAOA_TEST_DB_PASSWORD
|
||||
login: true
|
||||
attributes:
|
||||
createdb: false
|
||||
createrole: false
|
||||
superuser: false
|
||||
databases:
|
||||
- name: sub2api
|
||||
owner: sub2api
|
||||
@@ -606,6 +640,11 @@ objects:
|
||||
encoding: UTF8
|
||||
locale: C.UTF-8
|
||||
extensions: []
|
||||
- name: pikaoa_test
|
||||
owner: pikaoa_test
|
||||
encoding: UTF8
|
||||
locale: C.UTF-8
|
||||
extensions: []
|
||||
|
||||
exports:
|
||||
connectionStrings:
|
||||
@@ -764,6 +803,22 @@ exports:
|
||||
- scope: pikaoa
|
||||
secret: pikaoa-runtime
|
||||
key: DATABASE_URL
|
||||
- name: pikaoa-test-database-url
|
||||
sourceSecretRef: platform-db/pikaoa-test-db.env
|
||||
render:
|
||||
envKey: DATABASE_URL
|
||||
format: postgresql://$(PIKAOA_TEST_DB_USER):$(PIKAOA_TEST_DB_PASSWORD)@$(PGHOST):$(PGPORT)/$(PIKAOA_TEST_DB_NAME)?sslmode=require
|
||||
variables:
|
||||
PGHOST: 82.156.23.220
|
||||
PGPORT: "5432"
|
||||
writeToSecretSource:
|
||||
sourceRef: platform-infra/pikaoa-test.env
|
||||
key: DATABASE_URL
|
||||
mode: update-or-insert
|
||||
consumers:
|
||||
- scope: pikaoa-test
|
||||
secret: pikaoa-test-runtime
|
||||
key: DATABASE_URL
|
||||
|
||||
backup:
|
||||
phase: minimum-restoreable
|
||||
@@ -812,6 +867,9 @@ observability:
|
||||
- kind: psql-app-role
|
||||
database: pikaoa
|
||||
user: pikaoa
|
||||
- kind: psql-app-role
|
||||
database: pikaoa_test
|
||||
user: pikaoa_test
|
||||
- kind: disk-free
|
||||
path: /var/lib/postgresql/16/main
|
||||
minFreeGiB: 10
|
||||
|
||||
@@ -0,0 +1,36 @@
|
||||
# R1.5.9.4 任务报告
|
||||
|
||||
## 任务结果
|
||||
|
||||
- 在 `config/platform-db/postgres-pk01.yaml` 声明独立 `pikaoa_test` role、database、凭据 `sourceRef`、连接串 export、NC01 来源 HBA 和有界状态检查。
|
||||
- 测试凭据来源为 `platform-db/pikaoa-test-db.env`，连接串写入 `platform-infra/pikaoa-test.env`，consumer 为 `pikaoa-test-runtime/DATABASE_URL`。
|
||||
- 保持既有生产 `pikaoa` role、database、Secret export 和 consumer 声明不变。
|
||||
- 收紧 `platform-db postgres plan` 的 role、database 和 Secret 默认摘要，确保新增对象后仍保持有界可见。
|
||||
|
||||
## 交付证据
|
||||
|
||||
- 执行记录：[pikasTech/unidesk#2078](https://github.com/pikasTech/unidesk/issues/2078)。
|
||||
- 提交：[d281b560](https://github.com/pikasTech/unidesk/commit/d281b560746b0cd61b018a5d628490685b62d210)。
|
||||
- PR：[pikasTech/unidesk#2083](https://github.com/pikasTech/unidesk/pull/2083)。
|
||||
|
||||
## 验证摘要
|
||||
|
||||
- `bun --check scripts/src/platform-db.ts`：通过。
|
||||
- `git diff --check`：通过。
|
||||
- `bun scripts/cli.ts platform-db postgres plan --config config/platform-db/postgres-pk01.yaml`：显示 `pikaoa_test` role、database、Secret sourceRef 和连接串 export；输出包含 `mutation=false`、`valuesPrinted=false`。
|
||||
- `bun scripts/cli.ts platform-db postgres status --config config/platform-db/postgres-pk01.yaml`：对尚未落地的 `pikaoa_test` role、database 和 export 返回有界 actionable 摘要；未执行 mutation。
|
||||
- `bun scripts/cli.ts platform-db postgres export-secrets --config config/platform-db/postgres-pk01.yaml --dry-run`：显示独立测试凭据与连接串 export 的 create 计划；输出包含 `mutation=false`、`valuesPrinted=false`。
|
||||
- PR preflight：`MERGEABLE/CLEAN`，无 pending 或失败检查。
|
||||
|
||||
## 执行边界
|
||||
|
||||
- 未执行 live `platform-db postgres apply`。
|
||||
- 未写入任何 Secret source 文件。
|
||||
- 未触碰 NC01 k3s 运行对象。
|
||||
- 未扩展 PikaOA 产品源码或其他配置范围。
|
||||
|
||||
## 已知风险
|
||||
|
||||
- 当前 PK01 状态同时显示既有生产 `pikaoa` role、database 和 export 尚未落地。
|
||||
- owning YAML 的 live `apply` 是 shared apply；主代理后续执行时，production `pikaoa` 与新增 `pikaoa_test` 将被同批收敛。
|
||||
- 该 shared apply 风险不由本任务提前消除或绕过；执行 live apply 前必须由主代理明确确认影响范围，并继续保持 Secret 脱敏和非阻塞漂移 warning 边界。
|
||||
@@ -102,7 +102,7 @@
|
||||
##### R1.5.9.3 [completed]
|
||||
|
||||
按用户确认方案将测试架构定锚为现有 NC01 k3s 的 pikaoa-test namespace、PK01 host PostgreSQL 独立测试库与角色、YAML hostIP 端口，并更新 SPEC 与 [pikasTech/unidesk#2058](https://github.com/pikasTech/unidesk/issues/2058)，完成任务后将详细报告写入[任务报告](./details/pikaoa-enterprise-platform/R1.5.9.3_Task_Report.md)。
|
||||
##### R1.5.9.4 [in_progress]
|
||||
##### R1.5.9.4 [completed]
|
||||
|
||||
在 PK01 host PostgreSQL 声明独立 pikaoa_test database/role、Secret export 与 NC01 HBA，执行记录见 [pikasTech/unidesk#2078](https://github.com/pikasTech/unidesk/issues/2078)，完成任务后将详细报告写入[任务报告](./details/pikaoa-enterprise-platform/R1.5.9.4_Task_Report.md)。
|
||||
##### R1.5.9.5 [in_progress]
|
||||
|
||||
+15
-14
@@ -1113,27 +1113,28 @@ function compactPlan(
|
||||
transport: pg.postgres.network.transport,
|
||||
sslmode: pg.postgres.network.sslmode,
|
||||
},
|
||||
roles: pg.objects.roles.map((role) => ({
|
||||
roles: compactActionableSummary(pg.objects.roles.map((role) => ({
|
||||
name: role.name,
|
||||
exists: observedRoles.find((item) => item.name === role.name)?.exists ?? null,
|
||||
action: observedRoles.some((item) => item.name === role.name && item.exists) ? "none" : "create-or-update",
|
||||
})),
|
||||
databases: pg.objects.databases.map((database) => ({
|
||||
})), {
|
||||
passed: (item) => item.action === "none",
|
||||
missing: (item) => item.exists !== true,
|
||||
actionable: (item) => item.action !== "none",
|
||||
project: (item) => item,
|
||||
}),
|
||||
databases: compactActionableSummary(pg.objects.databases.map((database) => ({
|
||||
name: database.name,
|
||||
owner: database.owner,
|
||||
exists: observedDatabases.find((item) => item.name === database.name)?.exists ?? null,
|
||||
action: observedDatabases.some((item) => item.name === database.name && item.exists) ? "none" : "create",
|
||||
})),
|
||||
secrets: {
|
||||
ok: secrets.ok,
|
||||
root: secrets.root,
|
||||
entries: secrets.entries.map((entry) => ({
|
||||
sourceRef: entry.sourceRef,
|
||||
missingKeys: entry.missingKeys,
|
||||
action: entry.action,
|
||||
})),
|
||||
valuesPrinted: false,
|
||||
},
|
||||
})), {
|
||||
passed: (item) => item.action === "none",
|
||||
missing: (item) => item.exists !== true,
|
||||
actionable: (item) => item.action !== "none",
|
||||
project: (item) => item,
|
||||
}),
|
||||
secrets: compactSecretInspection(secrets),
|
||||
exports: pg.exports.connectionStrings.map((item) => ({
|
||||
name: item.name,
|
||||
sourceRef: item.sourceSecretRef,
|
||||
|
||||
Reference in New Issue
Block a user